Skip to content

Publish 6.2.2

Choose a tag to compare

View all tags
@zargarzadehm zargarzadehm released this 23 Jul 09:34
6.2.2
a8f067c

@rosen-bridge/watcher

6.2.2

Patch Changes

  • Fix cardano scanner and extractor to prevent events with failed transactions

Watcher operators, we kindly request you to update your watcher-service to version 6.2.2

For update, please pull the image and restart your service:

docker version:

- docker compose pull
- docker compose down
- docker compose up -d

📢 If you encounter any issues, create a ticket in https://discord.com/channels/1149394330981773393/1510264974923137226.

❗ Security Reminder: Do not respond to direct messages (DMs). Our team will never contact you via DM. Stay alert for potential scams.

Security Update

On 21 July, Rosen was the target of an attempted attack that generated 84 invalid events observed by watchers. The attack was unsuccessful and did not compromise the protocol. The invalid events were successfully mitigated because guards operate on different independent data sources. Since Rosen requires consensus among guards, the attack was unable to satisfy the required quorum.

What happened?

The attacker exploited a flaw in the Cardano event scanning logic. When retrieving transaction data from Koios and Ogmios, Rosen verified only the transaction CBOR and did not verify the final on-chain execution result. As a result, transactions that had failed on-chain could still be recognized by watchers as valid events and reported.

Although these invalid events were detected by watchers, they could not pass the guard validation stage. This issue only affected guards whose underlying data source reported the failed transactions incorrectly. Guards using other data sources correctly rejected those events. Because Rosen requires agreement among guards before an event can proceed, the attack failed and no invalid event was processed by the protocol.

What has changed?

This release addresses the issue by adding transaction result verification to both the Koios and Ogmios scanners. Watchers will now ignore failed Cardano transactions entirely.

Additionally, the recent Cardano blocks have been marked for rescanning to remove the previously reported invalid events. Your watcher will automatically redeem any commitments made on those invalid events, and no manual action is required.

What to expect after upgrading

After updating, you may notice the following:

  • Most commitments associated with the invalid events will be redeemed automatically by your watcher during the rescan process.
  • Three invalid events cannot be redeemed automatically. Guard operators will return the affected permits within the next 2–3 days.
  • There is also one legitimate Cardano event awaiting processing. Your watcher will commit to this event as part of normal operation.

If you have not received the returned permits after the stated period, please open a ticket in our Support channel (https://discord.com/channels/1149394330981773393/1510264974923137226).

Assets 2
Loading